Privacy Policy

Last updated: 14 July 2026

The Legacy Endowment CIC respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us or otherwise communicate with us.

This policy has been prepared in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable UK data protection and privacy legislation.

1. Who we are

The Legacy Endowment CIC is a community interest company limited by guarantee and incorporated in England and Wales.

• Company name: The Legacy Endowment CIC
• Company number: 17323132
• Website: https://thelegacyendowment.co.uk
• Registered office: 113 South Road, Haywards Heath, RH16 4LR
• Privacy contact: privacy@thelegacyendowment.co.uk

For the purposes of UK data protection law, The Legacy Endowment CIC is the controller of the personal information described in this policy. This means that we decide how and why that personal information is used.

2. Scope of this policy

This policy applies to personal information collected through this website and through communications connected with the website, including enquiries sent to us by email.

As our activities develop, we may provide additional privacy notices for donors, Founding Supporters, employees, volunteers, contractors, suppliers, event participants or other individuals. Those notices will explain any additional ways in which we use personal information.

3. Donations and payments

We do not currently accept donations, payments or financial contributions through this website.

We do not currently collect or process payment card details, bank account information or online payment information, and we do not currently use third-party payment platforms through the website.

Before online donations or payments are introduced, we will update this policy and provide appropriate privacy information explaining what financial information is collected, the payment providers involved, the relevant lawful bases and the applicable retention periods.

4. Personal information we collect

The personal information we collect will depend on how you interact with us.

Information you provide to us

When you contact us, we may collect:

• your name;
• your email address;
• your telephone number, where you choose to provide it;
• the organisation you represent;
• your role or job title;
• the contents of your enquiry or correspondence; and
• any other information you choose to provide.

Information collected automatically

When you visit our website, limited technical information may be collected automatically by our website, hosting provider or security systems. This may include:

• your Internet Protocol address;
• browser type and version;
• device type and operating system;
• the date and time of your visit;
• the pages or resources you access;
• the website from which you arrived; and
• technical information relating to website errors, security or attempted misuse.

This information is generally collected through server logs and strictly necessary website technologies. It is used to operate, maintain and protect the website.

Special category information

We do not ask website visitors to provide information about their racial or ethnic origin, health, religion, political opinions, sexual orientation or other special category information through the website.

Please avoid including sensitive personal information in general enquiries unless it is necessary. Where we receive such information, we will only use it where we have both a lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9 of the UK GDPR.

5. How we use your personal information

We may use your personal information for the following purposes:

• to receive, review and respond to enquiries;
• to communicate with people and organisations interested in the work of The Legacy Endowment CIC;
• to operate, administer, maintain and improve our website;
• to protect the security and integrity of our website, systems and information;
• to detect, prevent and investigate fraud, misuse, cyberattacks or other unlawful activity;
• to manage our relationships with professional advisers, suppliers and service providers;
• to maintain appropriate administrative and business records;
• to comply with legal, regulatory and governance obligations; and
• to establish, exercise or defend legal rights and claims.

6. Our lawful bases

Under the UK GDPR, we must have a lawful basis for each purpose for which we use personal information. Depending on the circumstances, we may rely on the following lawful bases:

• Legitimate interests: where the use of personal information is necessary for our legitimate interests in operating the CIC, responding to enquiries, communicating with stakeholders, administering the website, protecting our systems and managing our activities, provided that those interests are not overridden by your rights and interests.
• Steps before entering into a contract: where you ask us to take steps before entering into a contractual relationship with you.
• Performance of a contract: where the use of personal information is necessary to perform an agreement with you.
• Legal obligation: where we need to use or retain information to comply with a legal or regulatory requirement.
• Consent: where we have asked for and obtained your clear consent. Where we rely on consent, you may withdraw it at any time.

Where we rely on legitimate interests, we will consider the nature of the information, the purpose for which it is used, the reasonable expectations of the individuals concerned and the potential effect on their rights and freedoms.

7. Email updates and direct marketing

We do not currently operate a public email marketing or newsletter subscription service through this website.

We will not add you to a marketing mailing list merely because you contact us with an enquiry.

If we introduce newsletters, campaign updates or other electronic marketing in the future, we will provide clear information at the point of sign-up and obtain consent where required. Every marketing email will provide a straightforward way to unsubscribe.

8. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. Similar technologies may also be used to store or access information on your device.

Our website may use strictly necessary cookies or similar technologies that are required for:

• basic website functionality;
• website administration;
• security and fraud prevention;
• network management;
• remembering privacy or cookie choices; and
• maintaining authorised administrator sessions.

Strictly necessary cookies do not normally require consent because they are required to provide the website or a service requested by the user.

At the date of this policy, we do not intentionally use advertising cookies or behavioural profiling technologies on the website.

We will not place non-essential analytics, advertising or social media tracking cookies on your device unless we have first provided clear information and obtained appropriate consent. Where a cookie preference tool is provided, you will be able to reject non-essential cookies and change your preferences.

You can also control cookies through your browser settings. Disabling strictly necessary cookies may affect the operation of the website.

9. Comments, accounts and content uploads

We do not currently invite members of the public to create website accounts, upload images or other content, or publish comments on the website.

If these functions are introduced in the future, this policy will be updated before they are made available.

10. Embedded content and links to other websites

Our website may contain links to third-party websites or may display content hosted by another organisation, such as a video, map, social media post or external document.

When you follow a link to another website or interact with embedded content, the third party may collect information about you and may use cookies or similar technologies. That organisation will be responsible for its own use of your personal information.

We encourage you to read the privacy and cookie information provided by any third-party website you visit. We are not responsible for the privacy practices, security or content of external websites.

11. Who we share personal information with

We may share personal information with trusted organisations where this is necessary for the purposes described in this policy. These may include:

• our website hosting provider;
• website administrators and technical support providers;
• email, document storage and information technology providers;
• cybersecurity and website protection providers;
• professional advisers, including accountants, auditors, insurers and legal advisers;
• government departments, regulators, courts, law enforcement agencies or other public authorities where disclosure is required or permitted by law; and
• another organisation involved in a restructuring, merger or transfer of some or all of our activities, subject to appropriate confidentiality and data protection safeguards.

Service providers that process personal information on our behalf are required to handle it securely, act only on our documented instructions and comply with applicable data protection requirements.

We do not sell, rent or trade personal information.

As we do not currently accept donations through the website, we do not currently share website visitor information with online payment processors for donation processing.

12. International transfers

Some of our technology or service providers may process or store information outside the United Kingdom.

Where a restricted international transfer takes place, we will ensure that it is protected by an approved transfer mechanism. This may include:

• a destination covered by UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses;
• another legally recognised safeguard; or
• a permitted exception where the requirements for relying on that exception are satisfied.

Where required, we will also assess whether additional technical, contractual or organisational safeguards are necessary.

13. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, accounting, governance, security or reporting requirements.

Our usual retention periods are:

• General enquiries and correspondence: normally for up to 24 months after the last substantive contact, unless there is a continuing relationship or another reason to keep the information.
• Website and security logs: normally for up to 12 months, unless the information is required for an investigation, security incident or legal claim.
• Contracts, financial records and legally significant correspondence: normally for six years after the end of the relevant relationship or accounting period, unless a longer period is required by law.
• Consent records: for as long as necessary to demonstrate what consent was given and when it was obtained or withdrawn.
• Legal claims: for as long as necessary to establish, exercise or defend the relevant claim.

When personal information is no longer required, we will securely delete it, anonymise it or place it beyond operational use in accordance with our retention arrangements.

14. How we protect personal information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss, destruction or misuse.

These measures may include:

• access controls and password protection;
• multi-factor authentication where appropriate;
• secure website connections and encryption in transit;
• software updates and security patching;
• malware, firewall and website security controls;
• regular backups;
• restricted administrative access;
• supplier due diligence and contractual safeguards; and
• processes for identifying and responding to personal data breaches.

No internet transmission or information storage system can be guaranteed to be completely secure. However, we will take reasonable and proportionate steps to protect the information entrusted to us.

15. Your data protection rights

Depending on the circumstances, you may have the following rights under UK data protection law:

• Right to be informed: to receive clear information about how your personal information is used.
• Right of access: to request confirmation that we process your personal information and obtain a copy of that information.
• Right to rectification: to ask us to correct inaccurate information or complete incomplete information.
• Right to erasure: to ask us to delete personal information in certain circumstances.
• Right to restrict processing: to ask us to limit how we use personal information in certain circumstances.
• Right to data portability: to receive certain information in a structured, commonly used and machine-readable format where the legal conditions for this right apply.
• Right to object: to object to processing based on legitimate interests and to object at any time to the use of personal information for direct marketing.
• Rights relating to automated decision-making: to have safeguards applied where a significant decision is made solely by automated means.
• Right to withdraw consent: where we rely on consent, to withdraw that consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

These rights are not absolute and may be subject to legal exemptions or limitations.

We do not currently use personal information collected through this website to make decisions about individuals solely by automated means that produce legal or similarly significant effects.

16. How to exercise your rights

To exercise a data protection right, or to ask a question about how we use your personal information, please contact us at:

Email: privacy@thelegacyendowment.co.uk

Post:
The Legacy Endowment CIC
113 South Road, Haywards Heath, RH16 4LR

Please describe the information or processing activity your request concerns. We may need to ask for reasonable evidence of identity where this is necessary to protect personal information from unauthorised disclosure.

You will not normally be required to pay a fee. We will respond without undue delay and normally within one month. The response period may be extended where a request is particularly complex or where you have submitted several requests. We will tell you if an extension is required.

17. Complaints

If you have concerns about the way we have used your personal information, please contact us first so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113

18. Children’s information

This website is intended to provide general information about The Legacy Endowment CIC and is not designed specifically to collect personal information from children.

We do not knowingly collect personal information online from children under the age of 13. A child under 13 should not submit personal information through the website without the involvement of a parent or guardian.

If you believe that a child has provided personal information to us inappropriately, please contact us so that we can investigate and, where appropriate, delete it.

19. Changes to this policy

We may update this Privacy Policy when our activities, website services, suppliers or legal obligations change.

Any updated version will be published on this page and the “last updated” date will be revised. Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals.

20. Contact us

For questions about this Privacy Policy or the way The Legacy Endowment CIC handles personal information, please contact:

The Legacy Endowment CIC
Email: privacy@thelegacyendowment.co.uk
Address: 113 South Road, Haywards Heath, RH16 4LR

← Return to The Legacy Endowment